From d726a0d875179136cd5448fee72a09e7b1103fb5 Mon Sep 17 00:00:00 2001 From: atlas Date: Wed, 3 Jun 2026 21:43:02 +0200 Subject: [PATCH] docs: clarify nix eval is not fully sandboxed (IFD, fetchGit can reach network) --- docs/ci.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/ci.md b/docs/ci.md index 556c5e0a..9b43f675 100644 --- a/docs/ci.md +++ b/docs/ci.md @@ -67,7 +67,7 @@ A malicious `default.nix` or build script in a PR can therefore: - **Make arbitrary network requests** to any address reachable from the container. The container shares host netns, so `http://127.0.0.1:` is reachable. - **Write to the container filesystem**, including corrupting the runner's state dir or `.runner` credentials. -Note: nix *evaluation* (`nix flake check` with `--no-build`) is safer — evaluation is sandboxed at the nix level. Full `nix flake check` (which builds derivations) is not. +Note: `nix flake check --no-build` (eval-only) reduces the attack surface but does not eliminate it — `builtins.fetchGit`, `builtins.fetchurl`, and import-from-derivation can reach the network and filesystem during evaluation. The default CI workflow runs full `nix flake check` (builds derivations), which is the higher-risk path. ### Mitigation